How your documents are handled.

Where documents are stored

Uploaded documents are stored in a private Supabase Storage bucket with encryption at rest by default. Access is restricted to the systems and processes required to run your scan — there is no direct read/write access from the browser, only short-lived signed URLs issued by our backend.

Encryption standards

Documents are encrypted in transit using TLS 1.2 or higher between your browser and our servers, and encrypted at rest in storage.

How documents are processed

Uploaded documents are stored in Supabase Storage and analysed by routing the extracted content through OpenRouter to a large language model (currently Anthropic's Claude Sonnet). The model processes the content solely to return an analysis to Valify, does not retain uploaded documents after the analysis has been returned, and does not use your content to train models.

Data retention

Uploaded documents and their reports are retained for 90 days from the date of upload, then permanently deleted from our systems. Account and billing records are retained separately as required for legal and accounting purposes.

Who can access uploaded documents

Access to uploaded documents is restricted to the automated processing pipeline and a small number of authorised Valify personnel for support and debugging purposes only. Documents are never accessed directly from the browser — every read goes through a short-lived signed URL issued by our backend.

GDPR compliance

Valify is built to be compliant with UK GDPR and the Data Protection Act 2018. You have the right to access, correct, or request erasure of your data at any time — see our Privacy Policy for full detail, including how to make a data request.

Third-party processors

Valify uses the following third-party processors (sub-processors), each bound by its own data processing terms:

• Supabase — authentication, database and document storage
• OpenRouter — routes document content to the AI model used for analysis (currently Anthropic Claude)
• Stripe — payment processing and billing
• Resend — transactional email delivery
• Vercel — website hosting and content delivery

See our Privacy Policy for the full sub-processor list and international transfer safeguards.

Reporting a security concern

If you believe you have found a security issue affecting Valify, email hello@valify.co.uk with the details and we will respond as a priority.